Embedding the authentication in the link is both a security risk and more complex than simply relying on the cookie. They could have opted to do what Twitter d

Embedding the authentication in the link is both a security risk and more complex than simply relying on the cookie. They could have opted to do what Twitter does: Leave everything accessible wide open even if the file was created in a private context such as Twitter DM:s Locking down access to static files that you ideally would like to serve and cache straight from storage is a tricky thing in regards to performance, security and maintenance complexity.